Secureworks REvil September 2019

REvil can query the Registry to get random file extensions to append to encrypted files.

REvil can save encryption parameters and system information in the Registry.

REvil has used encrypted strings and configuration files.

REvil can exfiltrate host and malware information to C2 servers.

REvil can use the Windows command line to delete volume shadow copies and disable recovery.

REvil can identify the domain membership of a compromised host.

REvil has used HTTP and HTTPS in communication with C2.

REvil can identify the username, machine name, system language, keyboard layout, and OS version on a compromised host.

REvil has the ability to identify specific files and directories that are not to be encrypted.

REvil can use Native API for execution and to retrieve active services.

REvil can modify the Registry to save encryption parameters and system information.

GOLD SOUTHFIELD has used publicly-accessible RDP and remote management and monitoring (RMM) servers to gain access to victim machines.

REvil can launch an instance of itself with administrative rights using runas.

REvil can decode encrypted strings to enable execution of commands and payloads.

REvil has infected victim machines through compromised websites and exploit kits.

GOLD SOUTHFIELD has exploited Oracle WebLogic vulnerabilities for initial compromise.

GOLD SOUTHFIELD has distributed ransomware by backdooring software installers via a strategic web compromise of the site hosting Italian WinRAR.

GOLD SOUTHFIELD has breached Managed Service Providers (MSP's) to deliver malware to MSP customers.

REvil has the capability to destroy files and folders.

REvil can encrypt files on victim systems and demands a ransom to decrypt the files.

REvil has the capability to stop services and kill processes.

REvil can use vssadmin to delete volume shadow copies and bcdedit to disable recovery features.

GOLD SOUTHFIELD has conducted malicious spam (malspam) campaigns to gain access to victim's machines.

REvil has been distributed via malicious e-mail attachments including MS Word Documents.

REvil can identify system drive information on a compromised host.